Program generation method and program product

Abstract

There is provided with a program generation method, including: inputting a source program; inputting a memory protection policy in which functions included in the source program are classified into either of a plurality of domains each assigned an access control table; generating information which represents a relation between each global variable in the source program and domains utilizing the each global variable; every global variable, dividing domains utilizing the global variable into one or more high-order domains and one or more low-order domains, every global variable; every global variable, adding to the source program an instruction which sets access restriction on the global variable to reading and writing permission in access control tables of the high-order domains; and every global variable, adding to the source program an instruction which sets access restriction on the global variable to reading permission in access control tables of the low-order domains.

1 . A program generation method for generating a program to be executed in a system in which access from a CPU to a memory device is controlled based on an access control table describing access restriction for the memory device, comprising: 
 inputting a source program;    inputting a memory protection policy in which functions included in the source program are classified into either of a plurality of domains respectively, the access control table being assigned to each of the domains;    generating information which represents a relation between each global variable in the source program and domains utilizing the each global variable;    dividing domains utilizing the global variable into one or more high-order domains and one or more low-order domains;    adding to the source program an instruction which sets access restriction on the global variable to reading and writing permission in access control tables of the high-order domains; and    adding to the source program an instruction which sets access restriction on the global variable to reading permission in access control tables of the low-order domains.    
   
   
       2 . The method according to  claim 1 , wherein the high-order domain is a highest-order domain and the lower-order domains are domains other than the highest-order domain.  
   
   
       3 . The method according to  claim 1 , wherein if only one domain utilizes the global variable, the one domain is handled as the high-order domain.  
   
   
       4 . The method according to  claim 1 , wherein the instruction which sets access restriction to reading and writing permission and the instruction which sets access restriction to reading permission are added to a function which is executed first in the source program.  
   
   
       5 . The method according to  claim 1 , further comprising: 
 adding to a first function in the source program an instruction which sets access restriction on a memory area in a range from a stack pointer to a base pointer to reading and writing permission in an access control table of a domain to which the first function belongs in order to make it possible for the first function to access a stack area in a case where the first function is called by a second function; and    adding before a return instruction included in the first function an instruction which sets access restriction on the memory area to access inhibition in the access control table of the domain to which the first function belongs.    
   
   
       6 . The method according to  claim 1 , further comprising: 
 adding to the source program a first instruction which sets access restriction on an argument of a third function to reading and writing permission or to reading permission in an access control table of a domain to which the third function belongs in order to make it possible for the third function to access the argument when the third function is called by a fourth function belonging to a domain different from that of the third function; and    adding to the source program a second instruction which sets access restriction on the argument to access inhibition in the access control table of the domain to which the third function belongs in order to prevent the argument from being accessed from the domain to which the third function belongs after an execution of the third function ends.    
   
   
       7 . The method according to  claim 6 , wherein 
 the argument indicates a reference address,    the memory protection policy includes first information representing a memory address range from the reference address and second information representing access restriction to be set for the memory address range,    the adding the first instruction includes adding an instruction which sets access restriction on the memory address range from the reference address to access restriction represented by the second information, and    the adding the second instruction includes adding an instruction which sets access restriction on the memory address range from the reference address to access inhibition.    
   
   
       8 . The method according to  claim 7 , wherein 
 the first instruction is added to the third function and    the second instruction is added after the first instruction in the third function and before a return instruction in the third function.    
   
   
       9 . The method according to  claim 7 , wherein 
 the first instruction is added before a call instruction calling the third function in the fourth function, and    the second instruction is added after the call instruction in the fourth function.    
   
   
       10 . The method according to  claim 1 , further comprising: 
 detecting from the source program a dynamic memory securing instruction and a memory release instruction;    adding to the source program an instruction which sets access restriction on a memory area secured by the dynamic memory securing instruction to reading and writing permission in access control tables of a domain to which the detected dynamic memory securing instruction belongs and a high-order domain of that domain;    adding to the source program an instruction which sets access restriction on the secured memory area to reading permission in an access control table of a low-order domain of that domain; and    adding to the source program an instruction which sets access restriction on the memory area released by the memory release instruction to access inhibition in the access control tables of that domain, the high-order domain, and the low-order domain.    
   
   
       11 . The method according to  claim 10 , wherein 
 the instruction which sets access restriction to reading and writing permission and the instruction which sets access restriction to reading permission are added immediately before or immediately after the dynamic memory securing instruction, and    the instruction which sets access restriction to access inhibition is added immediately before or immediately after the memory release instruction.    
   
   
       12 . The method according to  claim 1 , further comprising: 
 adding to the source program, instructions which set access restriction on memory areas in which functions in the program are located at a time of an execution of the program to executable in access control tables of domains to which the functions belong, in order to make it possible for the functions to access the memory areas.    
   
   
       13 . The method according to  claim 12 , 
 further comprising calculating terminal addresses of the memory areas,    wherein the instructions to be added contain the terminal addresses of the memory areas respectively.    
   
   
       14 . The method according to  claim 12 , wherein the instructions which sets access restriction to executable are added to a function which is executed first in the source program.  
   
   
       15 . A program product for generating a program to be executed in a system in which access from a CPU to a memory device is controlled based on an access control table describing access restriction for the memory device, comprising modules for: 
 inputting a source program;    inputting a memory protection policy in which functions included in the source program are classified either of a plurality of domains respectively, the access control table being assigned to each of the domains;    generating information which represents a relation between each global variable in the source program and domains utilizing the each global variable;    dividing domains utilizing the global variable into one or more high-order domains and one or more low-order domains;    adding to the source program an instruction which sets access restriction on the global variable to reading and writing permission in access control tables of the high-order domains; and    adding to the source program an instruction which sets access restriction on the global variable to reading permission in access control tables of the low-order domains.    
   
   
       16 . The program product according to  claim 15 , further comprising modules for: 
 adding to a first function in the source program an instruction which sets access restriction on a memory area in a range from a stack pointer to a base pointer to reading and writing permission in an access control table of a domain to which the first function belongs, in order to make it possible for the first function to access a stack area in a case where the first function is called by a second function; and    adding before a return instruction included in the first function an instruction which sets access restriction on the memory area to access inhibition in the access control table of the domain to which the first function belongs.    
   
   
       17 . The program product according to  claim 15 , further comprising modules for: 
 adding to the source program a first instruction which sets access restriction on an argument of a third function to reading and writing permission or to reading permission in an access control table of a domain to which the third function belongs, in order to make it possible for the third function to access the argument when the third function is called by a fourth function belonging to a domain different from that of the third function; and    adding to the source program a second instruction which sets access restriction on the argument to access inhibition in the access control table of the domain to which the third function belongs, in order to prevent the argument from being accessed from the domain to which the third function belongs after an execution of the third function ends.    
   
   
       18 . The program product according to  claim 15 , further comprising modules for: 
 detecting from the source program a dynamic memory securing instruction and a memory release instruction;    adding to the source program an instruction which sets access restriction on a memory area secured by the dynamic memory securing instruction to reading and writing permission in access control tables of a domain to which the detected dynamic memory securing instruction belongs and a high-order domain of that domain;    adding to the source program an instruction which sets access restriction on the secured memory area to reading permission in an access control table of a low-order domain of that domain; and    adding to the source program an instruction which sets access restriction on the memory area released by the memory release instruction to access inhibition in the access control tables of that domain, the high-order domain, and the low-order domain.    
   
   
       19 . The program product according to  claim 15 , further comprising a module for 
 adding to the source program, instructions which set access restriction on memory areas in which functions in the program are located at a time of an execution of the program is executed to executable in access control tables of domains to which the functions belong, in order to make it possible for the functions to access the memory areas.